firecracker
Firecracker micro-VMs over KVM, with an
SSH-enabled rootfs and TAP networking (set up via sudo). The guest kernel is
auto-downloaded; you can manage images with:
heyvm mvm fetch-kernel
heyvm mvm build
Requires the Firecracker binary, /dev/kvm, and sudo for TAP setup. See the
FIRECRACKER_DRIVER.md reference in the mvm-ctrl crate for internals.
Backend name: firecracker.
firecracker_containerd
Firecracker driven through
firecracker-containerd,
which boots OCI images directly with CNI networking and supports publishing ports
(--open-port).
Configuration (environment variables):
| Variable | Default |
|---|---|
HEYVM_FIRECRACKER_CONTAINERD_ADDRESS |
/run/firecracker-containerd/containerd.sock |
HEYVM_FIRECRACKER_CONTAINERD_NAMESPACE |
default |
HEYVM_FIRECRACKER_CONTAINERD_SNAPSHOTTER |
devmapper |
HEYVM_FIRECRACKER_CONTAINERD_RUNTIME |
aws.firecracker |
HEYVM_FIRECRACKER_CONTAINERD_CTR_COMMAND |
firecracker-ctr (use sudo -n firecracker-ctr when unprivileged) |
Backend name: firecracker_containerd (alias firecracker-containerd).
libvirt
Full virtual machines via libvirt + QEMU + KVM. Uses the unprivileged
qemu:///session connection and cloud-init NoCloud for provisioning. The default
image is the Ubuntu 24.04 "Noble" cloud image.
Backend name: libvirt. See LIBVIRT_DRIVER.md in the mvm-ctrl crate.
kvm
Direct /dev/kvm management via the kvmbind crate. Each micro-VM runs as a
re-exec'd subprocess (<exe> kvm-run <id>). Linux x86_64 only at runtime.
Backend name: kvm.
docker
Standard Docker runtime running OCI images. The default image is ubuntu:24.04.
For container backends, an image of the form dockerfile:./Dockerfile builds from
a local Dockerfile.
Backend name: docker.
bubblewrap
Lightweight Linux isolation using bubblewrap
namespaces. A bwrap … sleep infinity supervisor process holds the sandbox open and
commands are run inside it via nsenter. This is the default backend on Linux —
no VM, very fast, but weaker isolation than a true micro-VM.
Backend name: bubblewrap.